CVE-2024-50659

MEDIUM

iPublish Media Solutions AdPortal 3.0.39 - Cross-Site Scripting via shippingAsBilling Parameter

Title source: llm

Description

Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.

References (3)

Core 3

Core References

Permissions Required

http://adportal.com

Broken Link

https://petercipolone.info/wp-content/uploads/2025/01/iPublishMedia_AdPortal3.0.39_CVEs.pdf

Broken Link

http://ipublish.com

Scores

CVSS v3 6.1

EPSS 0.0029

EPSS Percentile 20.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

ipublishmedia/adportal 3.0.39

Published Jan 07, 2025

Tracked Since Feb 18, 2026